GeminiJack: Zero-Click Data Theft via Google AI

GeminiJack: A Zero-Click Vulnerability in Google's Gemini AI

Researchers at Noma Labs have disclosed a critical vulnerability named GeminiJack in Google's Gemini AI tooling. The flaw lets attackers exfiltrate sensitive data, including Gmail, Calendar, and Docs content, with zero user interaction and zero alerting. There is no link to click and no warning to dismiss.

What happened

The attack starts with a shared document or a fake invitation that contains hidden instructions. When Gemini processes that content, it executes the embedded commands as if they were legitimate. Because the AI assistant already has access to the user's Google data, those hidden instructions can quietly pull information out, no clicks, no prompts, and no obvious sign that anything happened.

Why it matters

GeminiJack is a clear example of a prompt-injection class attack against an AI assistant that is wired into a user's most sensitive data. The zero-click, zero-alert nature makes it especially dangerous: traditional user-awareness defenses ("don't click suspicious links") simply do not apply when no interaction is required. As AI assistants gain broader access to mail, calendars, and documents, a single poisoned document becomes a viable, silent exfiltration path.

What to do

• Ensure your Google / Gemini tooling is on the latest patched versions as fixes roll out.
• Limit the scope of data that AI assistants can automatically read from Gmail, Calendar, and Docs.
• Treat untrusted shared documents and calendar invitations as potential injection vectors, not just phishing.
• Monitor for anomalous AI-driven data access and exfiltration patterns.

Read more: Gemini zero-click vulnerability

---

Shared from the CSC - Cloud Security Community community, by Yossi Pinhasov.

Want more like this? Join the CSC - Cloud Security Community → https://youcc.co.il/community